diff --git a/.gitignore b/.gitignore
index b2f9579..7faa922 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,4 @@
 .env
+k8s/secret.yml
 certs/
 .claude
diff --git a/CLAUDE.md b/CLAUDE.md
index 436b816..ca359dd 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -12,17 +12,18 @@ Transport: **streamable-http** (persistent process, independent of Claude Code s
 
 ## Key files
 
-- `docker-compose.yml` — defines the `mcp-atlassian` container (image `ghcr.io/sooperset/mcp-atlassian:latest`, port 9000)
+- `compose/docker-compose.yml` — defines the `mcp-atlassian` container (image `ghcr.io/sooperset/mcp-atlassian:latest`, port 9000)
+- `k8s/` — Kubernetes manifests (namespace `mcp`, secret, deployment, service)
 - `.env` — Jira credentials (`JIRA_URL`, `JIRA_USERNAME`, `JIRA_API_TOKEN`); never commit this file
 - `.mcp.json` — tells Claude Code to connect to `http://localhost:9000/mcp`; auto-loaded when Claude Code opens this directory
 
 ## Common commands
 
 ```bash
-docker compose up -d          # start the server
-docker compose down           # stop the server
-docker compose logs -f        # tail logs
-docker compose pull && docker compose up -d  # update to latest image
+docker compose -f compose/docker-compose.yml up -d          # start the server
+docker compose -f compose/docker-compose.yml down           # stop the server
+docker compose -f compose/docker-compose.yml logs -f        # tail logs
+docker compose -f compose/docker-compose.yml pull && docker compose -f compose/docker-compose.yml up -d  # update to latest image
 ```
 
 ## Credentials
@@ -35,6 +36,23 @@ Credentials live in `.env` (already in `.gitignore`). Required variables:
 | `JIRA_USERNAME` | Atlassian account email |
 | `JIRA_API_TOKEN` | Atlassian API token — generate at id.atlassian.com |
 
+## Kubernetes deployment
+
+```bash
+# 1. Create the secret from .env
+kubectl create secret generic mcp-jira-credentials -n mcp \
+  --from-literal=JIRA_URL="$(grep JIRA_URL .env | cut -d= -f2-)" \
+  --from-literal=JIRA_USERNAME="$(grep JIRA_USERNAME .env | cut -d= -f2-)" \
+  --from-literal=JIRA_API_TOKEN="$(grep JIRA_API_TOKEN .env | cut -d= -f2-)" \
+  --dry-run=client -o yaml | kubectl apply -f -
+
+# 2. Apply all manifests
+kubectl apply -f k8s/
+
+# 3. Access locally via port-forward
+kubectl port-forward -n mcp svc/mcp-jira 9000:9000
+```
+
 ## MCP tools
 
 Once the server is running and Claude Code is connected, Jira tools are available directly in this session (search issues, create/update tickets, etc.). The MCP server exposes the full mcp-atlassian tool surface.
diff --git a/docker-compose.yml b/compose/docker-compose.yml
similarity index 94%
rename from docker-compose.yml
rename to compose/docker-compose.yml
index 5d7b742..45e28a5 100644
--- a/docker-compose.yml
+++ b/compose/docker-compose.yml
@@ -4,7 +4,7 @@ services:
     ports:
       - "9000:9000"
     env_file:
-      - .env
+      - ../.env
     command: ["--transport", "streamable-http", "--port", "9000"]
     networks:
       - default
diff --git a/k8s/deployment.yml b/k8s/deployment.yml
new file mode 100644
index 0000000..539d44e
--- /dev/null
+++ b/k8s/deployment.yml
@@ -0,0 +1,24 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: mcp-jira
+  namespace: mcp
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: mcp-jira
+  template:
+    metadata:
+      labels:
+        app: mcp-jira
+    spec:
+      containers:
+        - name: mcp-jira
+          image: ghcr.io/sooperset/mcp-atlassian:latest
+          args: ["--transport", "streamable-http", "--port", "9000"]
+          ports:
+            - containerPort: 9000
+          envFrom:
+            - secretRef:
+                name: mcp-jira-credentials
diff --git a/k8s/namespace.yml b/k8s/namespace.yml
new file mode 100644
index 0000000..4c5793d
--- /dev/null
+++ b/k8s/namespace.yml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: mcp
diff --git a/k8s/secret.example.yml b/k8s/secret.example.yml
new file mode 100644
index 0000000..e7c14f9
--- /dev/null
+++ b/k8s/secret.example.yml
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: mcp-jira-credentials
+  namespace: mcp
+type: Opaque
+stringData:
+  JIRA_URL: "https://your-org.atlassian.net"
+  JIRA_USERNAME: "your-email@example.com"
+  JIRA_API_TOKEN: "your-api-token"
diff --git a/k8s/service.yml b/k8s/service.yml
new file mode 100644
index 0000000..a1fb45a
--- /dev/null
+++ b/k8s/service.yml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: mcp-jira
+  namespace: mcp
+spec:
+  selector:
+    app: mcp-jira
+  ports:
+    - port: 9000
+      targetPort: 9000